DIFC Solidifies Dubai’s Position as a Global Hub for Digital Economy by Strengthening Privacy Governance, Promoting Inclusive Cross-border Trade

Dubai International Financial Centre (DIFC), the leading global financial center in the Middle East, Africa, and South Asia (MEASA) region, today announced its membership of the Global Cross-Border Privacy Rules Forum (Global CBPR Forum).

The announcement was made at a recent workshop of the Global CBPR Forum held in the Philippines. This is a first among countries outside of the Asia-Pacific Economic Cooperation (a forum that promotes free trade among certain countries in the Pacific Rim). As a requirement for Membership, the Centre also joined the Global Cooperation Arrangement for Privacy Enforcement (the Global CAPE)

The move reinforces DIFC’s commitment to advancing interoperable, inclusive, responsive, and trusted privacy frameworks in line with the evolving needs of businesses and individuals worldwide. Additionally, it strengthens the Centre’s contribution to building the digital economy globally as well as in Dubai and the UAE, in line with the UAE Digital Economy Strategy.

The membership facilitates further global trade while safeguarding trust arising out of secure and more transparent cross-border data flows.

His Excellency Arif Amiri, Chief Executive Officer of DIFC Authority, commented, “Becoming the first jurisdiction in the region to receive Global Cross-Border Privacy Rules membership recognizes DIFC’s initiatives to advance data and privacy protection. The digital age, fuelled by global connectivity and technology, means information is ubiquitous and instantly shareable. This results in businesses, particularly in finance, handling unprecedented volumes of individual data electronically and internationally every day. DIFC has established effective laws, regulations, and compliance for more than 8,000 registered companies within the center, reflecting Dubai’s ongoing commitment to world-class standards and its vision to be at the forefront of the digital economy.”

The Cross-Border Privacy Rules (CBPR) System certifies organizations’ compliance with certain program requirements for the cross-border transfer of personal data. The CBPR system has operated under Asia-Pacific Economic Cooperation (APEC) since its inception. In 2022, the declaration of the establishment of the Global CBPR Forum—a framework that is not limited to jurisdictions in the APEC region but open to those all over the world—was published for the purpose of facilitating cross-border transfer of personal data over a wider area and the promotion of interoperability of regulations among jurisdictions.

In 2023, DIFC enacted the groundbreaking Regulation 10 in the MEASA region on the processing of personal data via autonomous and semi-autonomous systems such as artificial intelligence (AI) or generative machine learning technology. This paved the way for a more collaborative, transparent platform for interoperability of the many and varied guidelines and principles issued by sovereign governments and non-governmental organizations. Creating a plug-and-play space for the application of ‘best fit’ principles to AI technology development is fundamental, responsible, and ethical processing of personal data in such systems.

DIFC's recent Global CBPR membership follows its participation in the Global Privacy Assembly (GPA) in September this year in Seoul, South Korea. The event was the backdrop for the DIFC Commissioner's Office signing cooperation agreements with the data protection authorities of Brazil, the Isle of Man, Uganda and Kenya. These agreements are significant, as DIFC recently hosted the #Risk GCC event on 8 and 9 December 2025, which helped set the stage for DIFC hosting the GPA conference in Dubai the same week in 2026. The GPA is a network of more than 130 privacy and data protection authorities and serves as a global standard-setting and cooperation platform for regulators across jurisdictions.